TCP/IP Tutorial and Technical Overview - IBM Redbooks

► Authorization and accounting information can now be encrypted and
transmitted inside a ticket in the authorization data field. This facilitates the
extension of the authentication scheme to include an authorization scheme as
well.
► A binding is provided for the Generic Security Service API (GSSAPI) to the
Kerberos Version 5 implementation.
22.12 Remote access authentication protocols
Remote dial-in to the corporate intranet and to the Internet has made the remote
access server a very vital part of today's internetworking services. More and
more mobile users are requiring access not only to central-site resources, but to
information sources on the Internet. The widespread use of the Internet and the
corporate intranet has fueled the growth of remote access services and devices.
There is an increasing demand for a simplified connection to corporate network
resources from mobile computing devices, such as a notebook computer, or a
palmtop device for e-mail access.
The emergence of remote access has caused significant development work in
the area of security. The AAA (triple A) security model has evolved in the industry
to address the issues of remote access security. Authentication, authorization,
and accounting answers the questions who, what, and when, respectively. Here
we provide a brief description of each of the three As in the AAA security model:
Authentication This is the action of determining who a user (or entity) is.
Authentication can take many forms. Traditional
authentication uses a name and a fixed password. Most
computers work this way. However, fixed passwords have
limitations, mainly in the area of security. Many modern
authentication mechanisms utilize one-time passwords or
a challenge-response query. Authentication generally
takes place when the user first logs in to a machine or
requests a service of it.
Authorization This is the action of determining what a user is allowed to
do. Generally, authentication precedes authorization, but
again, this is not required. An authorization request might
indicate that the user is not authenticated. (we do not
know who they are.) In this case, it is up to the
authorization agent to determine if an unauthenticated
user is allowed the services in question. In current remote
authentication protocols, authorization does not merely
provide yes or no answers, but it can also customize the
service for the particular user.
872 TCP/IP Tutorial and Technical Overview